SBN-Client Stack Buffer Overflow — recv_msg() and ingest_app_message()

Disclosed by

Engagement National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
Disclosed date 5 May 2026 6 days ago
Priority P2 Bugcrowd's VRT priority rating
Status Resolved This vulnerability has been accepted and fixed

Summary by Excal1bur

Stack-based buffer overflow (CWE-121, CVSS 9.8) in NASA SBN-Client recv_msg() and ingest_app_message(). The 16-bit MsgSz field received from the network was used directly as a byte count without validation, allowing a remote attacker to overflow a 32,768-byte stack buffer by sending MsgSz=0xFFFF (overflow of 32,767 bytes). Both functions were affected: sbn_client.c and sbn_client_ingest.c. Fixed in PR #12.

Reported by Daniel Miranda Barcelona (Excal1bur).

SBN-Client Stack Buffer Overflow — recv_msg() and ingest_app_message()

Summary by Excal1bur

Activity